Denial of service in Cisco Wide Area Application Services

1) Denial of service

EUVDB-ID: #VU936

Risk: Low

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-6437

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote unauthenticated user to cause DoS conditions on the target system.
The weakness exists due to a lack of file size limitations for SSL system files stored on the disk. By sending a continuous stream of SSL traffic, attackers can cause the target service to deny.
Successful exploitation of the vulnerability will result in denial of service on the vulnerable system.

Mitigation

Update to version 5.3(5g)1 or 6.2(2.32).

Vulnerable software versions

Cisco Wide Area Application Services: 5.3.5 - 6.2.1

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161012-waas

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.